Terms & Conditions

By working with us you agree to our terms; being:

Version: 29 January 2026

Company details

Supplier: Juicy Media Ltd (registered in England and Wales, Company No. 05514688)

Registered Address: DISH, Heron House, 47 Lloyd Street, Manchester, M2 5LN

Head Office: Juicy Media Ltd, Unit 14, Royal Mills, 17 Redhill Street, Ancoats, M4 5BA

Email: [email protected]

Telephone: 0161 464 9252

1. About these terms

These Terms and Conditions (“Terms”) govern the supply of professional services, development services, and (where ordered) managed hosting and support services by Juicy Media Ltd (“Supplier”, “we”, “us”) to the customer (“Customer”, “you”).

These Terms, together with any proposal, statement of work, quotation, email confirmation, purchase order accepted by us, service schedule, and any schedules referenced in them, form the agreement between the parties (“Agreement”).

If there is a conflict between documents, the order of precedence is: (1) the Order/Statement of Work (including any special terms), (2) these Terms, (3) any other referenced documents, except that the DPA Schedule prevails for Personal Data processing conflicts.

2. Definitions and interpretation

In these Terms:

“Business Day” means a day other than a Saturday, Sunday or public holiday in England.
“Change” means a change to scope, requirements, deliverables, timescales, costs, assumptions, or dependencies.
“Customer Materials” means all content, data, assets, branding, specifications, credentials, and instructions provided by the Customer.
“Deliverables” means the outputs we agree to provide (for example: designs, code, configurations, documentation, content templates, or reports).
“Fees” means the charges payable for the Services.
“Hosting Services” means hosting, monitoring, maintenance, backup, and related managed services we provide for systems we operate on your behalf (where ordered).
“Order” means a proposal, statement of work, quotation, email confirmation, or purchase order we accept that describes the Services, Fees, timeline, and assumptions.
“Services” means the services described in the Order, including any Deliverables and (if applicable) Hosting Services.
“Personal Data” has the meaning given in UK GDPR.
“UK GDPR” means the UK General Data Protection Regulation and the Data Protection Act 2018, as amended.

Headings are for convenience only and do not affect interpretation. References to “including” are without limitation.

3. Scope of Services

3.1 We will provide the Services described in the relevant Order. Services may include, for example:

Design, user experience (UX/UI), prototyping and content design
Web and application development using frameworks such as Laravel, Symfony, CakePHP, Nuxt.js and Next.js
CMS build and support including WordPress, Drupal, Joomla, Concrete5 and Umbraco
Frontend development including Vue.js, React, React Native, Sass, PWA, HTML, JavaScript, CSS and Bootstrap
Backend development including PHP and Node.js
Database design and integration including MySQL, PostgreSQL, MongoDB, Elasticsearch and SQLite
DevOps and delivery practices including Docker, CI/CD, GitLab, Atlassian, JetBrains tooling and artefact repositories (e.g., JFrog)
Cloud and platform services, which may include AWS, Azure, Google Cloud, OVH, Nutanix, OpenShift, GovPaaS, MODCloud and D2S, as required by the Order
Security and monitoring activities such as logging, alerting, vulnerability scanning and secure configuration hardening (tooling may include Huntress, Sentry, Trivy, Nessus, Burp Suite, Datadog, OWASP testing practices, Cloudflare, Nmap and Kali)
Managed Hosting Services (where ordered), including monitoring, backups, patching, and incident response

3.2 Unless expressly stated in an Order, the Services do not include legal advice, regulatory advice, content ownership verification, penetration testing, or procurement of third-party licences/subscriptions.

3.3 Any third-party licences, subscriptions, usage-based cloud charges, domain registrations, and app store fees are excluded from Fees unless expressly included in the Order.

4. Orders, change control, and delivery

4.1 Services begin when we confirm acceptance of an Order in writing.

4.2 Any project plan, milestones, or delivery dates are based on timely Customer input, approvals, and access to systems.

4.3 Where a Change is requested, we will assess impact on scope, timetable, and Fees and may issue a change request. We are not obliged to implement a Change unless agreed in writing.

4.4 We will not be responsible for delay caused by late approvals, missing information, changes requested by the Customer, or third-party dependencies.

5. Fees, invoicing, and payment

5.1 Fees are as set out in the Order and are exclusive of VAT unless stated otherwise.

5.2 Unless agreed otherwise, invoices are payable within 28 days of invoice date.

5.3 Hosting Services are typically invoiced one month in advance unless the Order states otherwise.

5.4 If you dispute an invoice, you must notify us within 14 days of receipt with reasonable detail; undisputed portions remain payable.

5.5 We may suspend Services (including Hosting Services) where sums due are overdue and not subject to a genuine dispute, after giving reasonable notice.

5.6 Late payment: where applicable and lawful, we may charge interest and reasonable recovery costs in line with the Late Payment of Commercial Debts (Interest) Act 1998.

6. Customer responsibilities

6.1 You will provide timely access to systems, accounts, personnel, and information reasonably required to deliver the Services.

6.2 You are responsible for the accuracy, legality, and ownership or licensing of any Customer Materials you provide (including content, images, data, and trademarks).

6.3 You are responsible for your own compliance obligations relating to your content and activities (including any sector-specific requirements), unless the Order states otherwise.

6.4 You are responsible for maintaining appropriate internal controls for your users (including strong authentication, access control, and approvals) unless those controls are expressly included in the Hosting Services scope.

7. Hosting Services (UK sovereign hosting)

7.1 If Hosting Services are included in an Order, we will provide them using UK-hosted infrastructure by default (UK sovereign data centre locations), unless you instruct us in writing to use another location or configuration.

7.2 Where cloud platforms are used, we will provision services in UK regions or UK sovereign environments where available and suitable for the Service. Some platform services (for example global content delivery, threat protection, support tooling, or telemetry) may involve processing outside the UK; where Personal Data is involved, such processing will be handled in accordance with Schedule [DPA].

7.3 Planned maintenance: we may perform routine maintenance and updates. Where reasonably practical, we will provide advance notice and schedule maintenance to minimise impact.

7.4 Backups and recovery: where included in the Order, we will implement backups and restoration procedures appropriate to the Service. Recovery objectives (RPO/RTO) apply only if expressly agreed in writing.

7.5 Service levels: if service levels apply, they will be set out in a separate SLA or Order. Where there is an SLA, service credits (if any) are your sole and exclusive remedy for service level failures.

8. Acceptable use

8.1 You must not use Hosting Services (or any environments we operate for you) to store, transmit, or process material that is unlawful, harmful, or infringes third-party rights.

8.2 You must not attempt to gain unauthorised access to any system, introduce malware, or perform security testing without our written approval and an agreed scope.

8.3 You must not interfere with availability or security of the Services, including by excessive automated requests, scanning, or misconfigured integrations.

8.4 Security testing (penetration testing and vulnerability assessments) You must not carry out (or commission a third party to carry out) any penetration testing, vulnerability scanning/assessment, or other security testing against our networks, infrastructure, or Services without our prior written approval. Any approved testing must be pre-notified, time-bound, and performed strictly within an agreed written scope, including target IPs/URLs, methods, rate limits, and points of contact. Unauthorised testing may be treated as a security incident and may result in suspension of access to protect the Services and other customers.

9. Intellectual property

9.1 Pre-existing materials: each party retains ownership of its pre-existing intellectual property, including templates, libraries, tools, know-how, and reusable components.

9.2 Deliverables created specifically for you under a paid Order: subject to full payment of all sums due, we grant you a perpetual, worldwide licence to use the Deliverables for your internal business purposes.

9.3 Where an Order expressly states that ownership is assigned to you, we will assign our rights in the Deliverables upon full payment, excluding third-party components and our pre-existing materials.

9.4 Open-source and third-party components: Deliverables may include open-source or third-party software subject to their licence terms. We do not transfer ownership of such components.

10. Confidentiality

10.1 Each party will keep the other party’s confidential information confidential and use it only to perform its obligations under the Agreement.

10.2 Confidential information does not include information that is public through no fault of the receiving party, or independently developed without use of the other party’s confidential information.

10.3 Each party will apply appropriate safeguards to protect confidential information from unauthorised access, disclosure, or loss.

11. Data protection

11.1 Each party will comply with applicable data protection law, including UK GDPR and the Data Protection Act 2018.

11.2 Where we process Personal Data on your behalf as a Processor, the Data Processing Agreement in Schedule [DPA] applies.

11.3 For information about how we process personal data as a Controller for our own business purposes (for example website enquiries, marketing, and recruitment), please see the relevant policies on our website (linked at the end of this document).

12. Warranties

12.1 We warrant that we will provide the Services with reasonable care and skill.

12.2 Except as expressly stated, all other warranties, conditions, and terms implied by law are excluded to the fullest extent permitted by law.

12.3 You acknowledge that software and hosting services are complex and may be affected by third-party platforms; we do not warrant that Services will be error-free or uninterrupted, but we will use reasonable efforts to remedy material issues within scope.

13. Liability

13.1 Nothing in these Terms limits or excludes liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) breach of confidentiality; or (d) any liability which cannot legally be limited.

13.2 Subject to clause 13.1, we will not be liable for indirect or consequential loss, loss of profits, loss of revenue, loss of goodwill, or business interruption.

13.3 Subject to clause 13.1 and to the extent permitted by law, our total aggregate liability arising out of or in connection with the Services in any 12 month period will not exceed the fees paid (and payable) by you for the Services giving rise to the claim in that period, unless otherwise agreed in the Order.

14. Termination

14.1 Either party may terminate an Order (or the Agreement) on written notice if the other party commits a material breach and, where the breach is capable of remedy, fails to remedy it within 14 days of notice.

14.2 We may suspend or terminate Hosting Services immediately where required to protect security or comply with law, or where undisputed invoices are materially overdue.

14.3 On termination: (a) fees for work performed and committed costs become payable; (b) access to Hosting Services may be removed after a reasonable handover period (where applicable); and (c) data return/deletion will be handled in accordance with Schedule [DPA] where Personal Data is processed.

15. Force majeure

Neither party will be liable for failure or delay caused by events beyond its reasonable control, including outages or failures of third-party networks, platforms, utilities, or cloud providers, provided the affected party uses reasonable efforts to mitigate the impact.

16. Third-party services

16.1 The Services may depend on third-party products and services (including hosting platforms, APIs, plugins, and licences).

16.2 Third-party terms apply to those products and services. We are not responsible for third-party outages, changes, or withdrawal of service, but we will use reasonable efforts to support you in mitigation and migration where agreed.

17. Notices

17.1 Notices must be in writing and sent to the addresses set out at the start of these Terms, or such other address as notified in writing.

17.2 Notices may be sent by email for operational communications, and by recorded delivery (or equivalent tracked service) for formal legal notices.

18. General

18.1 Assignment: you may not assign or transfer the Agreement without our prior written consent. We may assign the Agreement to a successor in connection with a merger, acquisition, or business transfer, provided this does not materially reduce your rights.

18.2 Entire agreement: the Agreement is the entire agreement between the parties in relation to its subject matter and supersedes prior discussions and correspondence.

18.3 Severance: if any provision is held invalid, the remainder remains in force.

18.4 Waiver: a failure to enforce any provision is not a waiver of that provision.

19. Governing law and jurisdiction

This Agreement and any dispute or claim arising out of or in connection with it shall be governed by the laws of England and Wales, and the courts of England and Wales shall have exclusive jurisdiction, unless otherwise agreed in writing.

The following policies are published on our website and apply where relevant. They are incorporated by reference where applicable:

This Schedule forms part of the Agreement between Juicy Media Ltd (the “Supplier/Processor”) and the Customer (the “Controller”). It sets out the terms required by UK GDPR Article 28 and the Data Protection Act 2018 for the Supplier’s processing of Personal Data on the Customer’s behalf.

1. Definitions

1.1 In this Schedule, the terms “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, “Special Category Data”, and “Supervisory Authority” have the meanings given in UK GDPR.

1.2 “UK GDPR” means the UK General Data Protection Regulation as incorporated into UK law, as amended from time to time, together with the Data Protection Act 2018 and any applicable UK data protection legislation.

1.3 “Sub-processor” means any Processor engaged by the Supplier to Process Personal Data on behalf of the Customer.

2. Processing instructions

2.1 The Supplier shall Process Personal Data only on documented instructions from the Customer (including as set out in this Schedule and the Agreement), unless required to do so by UK law. Where UK law requires Processing, the Supplier will inform the Customer of that legal requirement before Processing (unless the law prohibits such information on important grounds of public interest).

2.2 The Customer warrants that its instructions comply with UK GDPR and that it has a lawful basis for Processing and providing the Personal Data to the Supplier.

2.3 If the Supplier believes an instruction infringes UK GDPR or other applicable data protection laws, it will inform the Customer without undue delay.

3. Confidentiality

The Supplier shall ensure that persons authorised to Process Personal Data are bound by confidentiality obligations and receive appropriate data protection and security training.

4. Security of processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, the Supplier shall implement and maintain appropriate technical and organisational measures (“TOMs”) to ensure a level of security appropriate to the risk.

The Supplier’s baseline TOMs are described in Appendix 2. The Supplier may update TOMs to reflect evolving threats and best practices, provided such updates do not materially reduce protection.

5. Sub-processing

The Customer provides the Supplier with general written authorisation to engage Sub-processors for the Processing of Personal Data, subject to this clause.

The Supplier will ensure each Sub-processor is subject to written terms that provide at least the same level of protection as this Schedule and will remain fully liable for Sub-processor performance.

The Supplier will notify the Customer in advance of material changes to Sub-processors where reasonably practicable. The Customer may object on reasonable grounds related to data protection. If unresolved, the Customer may terminate the affected Services without penalty for the unperformed portion.

6. International transfers

The Supplier will host and process Customer Personal Data in UK locations by default unless otherwise agreed in writing.

The Supplier shall not transfer Personal Data outside the UK unless: (a) the Customer has provided documented instructions to do so; and (b) the transfer is made in compliance with UK GDPR transfer requirements (including use of the UK IDTA, the UK Addendum to EU SCCs, and/or an adequacy decision), together with any required supplementary measures.

7. Assistance

The Supplier shall assist the Customer, taking into account the nature of Processing, to fulfil obligations to respond to Data Subject rights requests.

If the Supplier receives a request directly from a Data Subject, it shall promptly notify the Customer and not respond substantively unless instructed by the Customer.

The Supplier shall provide reasonable assistance with security obligations, breach notifications, DPIAs and prior consultation, to the extent relevant to the Services. The Supplier may charge reasonable fees for assistance outside agreed scope.

8. Personal Data Breach

The Supplier shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this Schedule.

Notifications will include available information about the breach, likely consequences, mitigation measures, and a contact point.

9. Deletion or return

At the Customer’s choice, on termination or expiry, the Supplier shall return Personal Data to the Customer and/or delete it (including copies), unless UK law requires storage.

Deletion will be performed within a reasonable time and in accordance with backup retention cycles, with data removed from active processing once deletion is initiated.

10. Audits and compliance information

The Supplier shall make available information reasonably necessary to demonstrate compliance with this Schedule and UK GDPR Article 28.

The Customer may conduct an audit no more than once per 12 months (or more frequently following a Personal Data Breach), subject to reasonable notice, confidentiality, and avoiding undue disruption. Where appropriate, third-party assurance reports may be provided instead of on-site audits.

11. Order of precedence

If there is a conflict between this Schedule and the Agreement relating to Processing of Personal Data, this Schedule shall prevail to the extent of the conflict.

Appendix 1 – Sub-processors and platforms

Depending on the Order, the Supplier may use one or more of the following platforms or providers, typically configured for UK regions or UK sovereign environments where available and appropriate:

Amazon Web Services (AWS)
Microsoft Azure
Google Cloud Platform (GCP)
OVHcloud
Nutanix
Red Hat OpenShift
GovPaaS
MODCloud
D2S

The Supplier may also use specialist security, monitoring, ticketing, analytics, email delivery and content delivery providers as required for service delivery. Where any Sub-processor processes Personal Data outside the UK, the Supplier will ensure an appropriate UK transfer mechanism is in place in accordance with clause 6.

Appendix 2 – Security measures (TOMs)

Role-based access control (RBAC), least privilege, and MFA for privileged access
Secure remote administration (key-based SSH/VPN) and logging of administrative actions where practical
Encryption in transit (TLS 1.2+) and encryption at rest for storage and backups where supported
Routine patching and vulnerability management using risk-based remediation timelines
Monitoring and alerting for availability and security events; incident response runbooks and escalation
Regular backups and tested restoration procedures where included in scope; documented RPO/RTO if agreed
Secure development and change control using version control, peer review and CI/CD practices where applicable

Appendix 3 – Processing details

Subject matter of Processing: Provision of hosting, support, maintenance, monitoring, and related managed services for systems we operate on the Customer’s behalf.

Duration: For the term of the Agreement and any agreed retention period for backups and secure deletion/return.

Nature and purpose: Hosting and operation of the Customer’s service; storage, transmission and access to data; monitoring, troubleshooting and incident response; routine maintenance and updates.

Types of Personal Data: May include contact details, user account identifiers, authentication tokens, IP addresses and logs, user-submitted content, and any other Personal Data the Customer chooses to store or process within the service.

Categories of Data Subjects: Customer staff and representatives; end users of the Customer’s website/application; subscribers, members, applicants, or other individuals whose data is processed via the Customer’s service.

Special Category Data: Not intended unless the Customer chooses to collect/store it. Where processed, the Customer must ensure an appropriate lawful basis and additional safeguards.

Controller obligations: The Customer remains responsible for providing lawful instructions, transparency to Data Subjects, configuring retention and access controls, and responding to Data Subject requests and regulatory queries (with Supplier assistance as set out above).